USER-CONVENIENT AUTHENTICATION METHOD AND APPARATUS USING A MOBILE AUTHENTICATION APPLICATION

• US 20140040628A1
• Filed: 08/02/2013
• Published: 02/06/2014
• Est. Priority Date: 08/03/2012
• Status: Active Grant

• Current Assignee: Onespan North America Incorporated (OneSpan, Inc.)
• Original Assignee: Vasco Data Security Incorporated (OneSpan, Inc.)
• Inventors: Coulier, Frank, FORT, NICOLAS, Teixeron, Guilaume
• Granted Patent: US 9,710,634 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G09C 5/00 Ciphering apparatus or methods not provided for in the preceding groups, e.g. involving the concealment or deformation of graphic data such as designs, written or printed messages
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

Methods, apparatus, and systems for securing application interactions are disclosed. Application interactions may be secured by, at a user authentication device, capturing a signal emitted by an access device encoded with an authentication initiating message including an application identifier, decoding the signal and obtaining the authentication initiating message, retrieving the application identifier, presenting a human interpretable representation of the application identity to the user, obtaining user approval to generate a response message available to a verification server, generating a dynamic security value using a cryptographic algorithm that is cryptographically linked to the application identity, and generating a response message including the generated dynamic security value; making the response message available to a verification server; and, at the verification server, receiving the response message, verifying the response message including verifying the validity of the dynamic security value, and communicating the result of the verification of the response message to the application.

Claims

1. A method for securing interaction with an application by a user who remotely accesses said application through an access device that is connected to an application server hosting said application, comprising the steps of:

at a user authentication device capturing a signal emitted by the access device, said signal encoded with an authentication initiating message, said authenticating initiating message comprising at least an application identifier corresponding to an identity of the application;

at the user authentication device decoding said signal and obtaining the authentication initiating message;

at the user authentication device retrieving from the authentication initiating message the application identifier;

at the user authentication device using the application identifier to obtain a human interpretable representation of the application identity and presenting the obtained application identity representation to the user using a user output interface of the user authentication device;

at the user authentication device obtaining from the user, using a user input interface of the user authentication device, an approval for generating a response message and making the response message available to a verification server;

at the user authentication device generating a dynamic security value using a first cryptographic algorithm parameterized with a cryptographic dynamic security value generation key and using at least one personalized data element that is associated with the particular user or the particular user authentication device, wherein the generated dynamic security value is cryptographically linked to the application identity presented to the user;

at the user authentication device generating a response message comprising at least the generated dynamic security value;

making the generated response message available to a verification server;

at the verification server receiving the response message;

verifying the response message including verifying the validity of the dynamic security value;

communicating the result of the verification of the response message to the application.

2. The method of claim 1 wherein the response message further comprises a data element that is indicative of an identity of the user or an identity of the user authentication device and wherein said data element indicative of the user identity or the user authentication device identity is used to determine a user identity and wherein said user identity is also communicated to the application.

3. The method of claim 2 wherein the user identity is determined also as a function of the application identity.

4. The method of claim 1 wherein all application dependent data used to obtain the application identity representation are obtained by the user authentication device from a source external to the user authentication device or from the authentication initiating message.

5. The method of claim 1 further comprising the steps of:

generating a server credential to be included in the authentication initiating message, said generating using a second cryptographic algorithm parameterized with a cryptographic server credential generation key;

at the user authentication device retrieving from the authentication initiating message the included server credential;

at the user authentication device verifying the server credential using a third cryptographic algorithm parameterized with a cryptographic server credential verification key.

6. The method of claim 5 wherein the application identifier comprised in the authentication initiating message is cryptographically linked to the server credential.

7. The method of claim 1 wherein the step of generating a response message further comprises:

at the user authentication device including in the response message generated by the user authentication device a data element indicative of the application identity representation presented to the user.

8. The method of claim 7 further comprising:

at the verification server verifying whether the data element that is indicative of the application identity representation presented to the user is consistent with the application identity indicated by the application identifier comprised in the authentication initiating message.

9. The method of claim 1 further comprising the steps of:

at the user authentication device retrieving from the authentication initiating message transaction related data comprised in the authentication initiating message;

at the user authentication device presenting the retrieved transaction related data using a user output interface of the user authentication device; and

wherein the generated dynamic security value is cryptographically linked to the transaction related data.

10. The method of claim 9 further comprising the steps of:

generating a server credential to be included in the authentication initiating message, said generating using a second cryptographic algorithm parameterized with a cryptographic server credential generation key;

at the user authentication device retrieving from the authentication initiating message the included server credential;

at the user authentication device verifying the server credential using a third cryptographic algorithm parameterized with a cryptographic server credential verification key;

wherein the server credential is cryptographically linked to the transaction related data.

11. The method of claim 9 further comprising the steps of:

at the user authentication device including in the response message generated by the user authentication device data elements indicative of the transaction related data presented to the user; and

at the verification server verifying whether the data elements that are indicative of the transaction related data presented to the user are consistent with the transaction related data comprised in the authentication initiating message.

12. The method of claim 1 wherein

the dynamic security value generation key comprises a secret personalized key;

and wherein

the user authentication device calculates the dynamic security value by cryptographically combining the dynamic security value generation key with at least a dynamic input value; and

wherein

said dynamic input value comprises at least one of a time-related value provided by a time-mechanism in the user authentication device, a counter-related value stored and maintained by the user authentication device, or a challenge comprised in the authentication initiating message.

13. The method of claim 12 wherein the user authentication device calculates the dynamic security value by cryptographically combining the dynamic security value generation key also with a data element that is indicative of the application identity representation presented to the user.

14. The method of claim 12 wherein:

the user authentication device retrieves from the authentication initiating message transaction related data comprised in the authentication initiating message and presents these transaction related data to the user; and

wherein

the user authentication device calculates the dynamic security value by cryptographically combining the dynamic security value generation key also with data elements that are indicative of the transaction related data presented to the user.

15. An apparatus for generating authentication credentials comprising:

a processing component adapted for processing data;

a storage component for storing data;

a user interface component comprising a first user output interface for presenting outputs to a user and an input user interface for receiving input from the user; and

a data input interface adapted to capture a signal emitted by a second user output interface of an access device that the user is using for remotely accessing an application over a computer network, said signal encoded with an authentication initiating message, said authenticating initiating message comprising at least an application identifier corresponding to an identity of said application;

whereby the apparatus is adapted to decode said signal and obtain the authentication initiating message;

retrieve from the authentication initiating message the application identifier;

use the application identifier to obtain a human interpretable representation of the application identity and present the obtained application identity representation to the user using the first user output interface;

obtain from the user, using the user input interface, an approval for generating a response message and making the response message available to a verification server;

generate a dynamic security value using a first cryptographic algorithm parameterized with a cryptographic dynamic security value generation key and using at least one personalized data element that is associated with the user or the apparatus, wherein the generated dynamic security value is cryptographically linked to the application identity presented to the user; and

generate a response message comprising at least the generated dynamic security value.

16. The apparatus of claim 15 further adapted to present the generated response message to the user using the first user output interface.

17. The apparatus of claim 15 further comprising a data communications interface adapted to communicate said response message to a verification server.

18. A system for securing interaction with an application by a user who remotely accesses said application through an access device that is connected to an application server hosting said application, comprising:

a plurality of user authentication devices as claimed in claim 15; and

a verification server adapted to receive a response message generated by any of the plurality of user authentication devices, and adapted to verify the received response message including verifying the validity of the dynamic security value comprised in the response message, and adapted to communicate the result of the verification of the response message to the application.